PT-2025-36263 · Linux+3 · Linux Kernel+3

Published 2025-08-07 · Updated 2026-04-07 · CVE-2025-38733

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel related to memory management on s390 systems. The lowcore region was incorrectly mapped with the identity mapping, potentially leading to successful NULL pointer accesses instead of expected exceptions. This occurred regardless of the relocate lowcore command line option, and in cases where the option was specified, the lowcore was mapped twice. The issue was addressed by preventing the mapping of the first two pages of physical memory with the identity mapping.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-15742

CVE-2025-38733

DSA-6008-1

OPENSUSE-SU-2025:20081-1

SUSE-SU-2025:21074-1

SUSE-SU-2025:21139-1

SUSE-SU-2025:21179-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1271

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38733.json · Exploit
• https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87 · Patch
• https://cve.org/CVERecord?id=CVE-2025-38733 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:20081-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-38733 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-38733 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15742 · Security Note
• https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:21139-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38733 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38733 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-38733 · Vendor Advisory
• https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-38733 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21074-1 · Vendor Advisory